ASD ISM 0864 Prevent modifications to security settings on mobile devices
What it says
Mobile devices prevent personnel from disabling or modifying security functionality once provisioned.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishMobile devices ensure users cannot change or disable security features once set up.
This control ensures that once security settings are configured on a mobile device, they cannot be turned off or changed by someone not authorised to do so. This is important to prevent accidental or intentional weakening of security, which could expose sensitive information or lead to data breaches.
Free. Save your status, tasks and notes.
Why it matters
If users can disable or alter provisioned mobile security features, devices can become non-compliant, enabling unauthorised access and data leakage.
How to implement
IT team: Configure mobile device management software to lock security settings after initial setup.
This involves setting up policies that restrict changes to security features such as PIN codes, encryption, and remote wipe capabilities.
System owner: Work with your IT provider to define and document the essential security features that must be locked down.
This involves determining which features are critical to maintain, such as firewalls, antivirus programs, and location tracking.
IT security manager: Clearly communicate to all staff why security settings on their work devices cannot be modified.
Hold a training session or distribute a simple guide explaining the potential risks of tampering with these configurations.
Managers: Regularly review and update the list of mobile devices and ensure they're enrolled in the device management system.
Check that all new devices are properly set up before they are handed out to staff.
Procurement team: Ensure all new mobile devices are compatible with your organisation's mobile device management system rules.
This includes checking specifications with vendors to confirm they support necessary security configurations before purchase.
Keep it running
Use MDM to enforce non-removable security profiles and restrict user changes; regularly review compliance reports to confirm key settings remain locked.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The mobile device configuration policy document: Ensure it includes rules that lock security settings on devices.
Look at
Detailed descriptions of settings that cannot be changed.
Good evidence
Is a comprehensive policy outlining security locking procedures for all device types.
- Check 2 of 5What an auditor asks for
Ask for
A report from the mobile device management system: Check for a list of devices and their security configuration status.
Look at
Settings such as encryption and passcode complexity. Good evidence shows 100% compliance with the security configuration policy.
- Check 3 of 5What an auditor asks for
Ask for
Training records covering mobile device security. Look to see that all staff have completed sessions on the importance of maintaining security settings.
Good evidence
Includes attendee lists and training dates.
- Check 4 of 5What an auditor asks for
Ask for
To see a sample of device compliance reports generated automatically by the management system.
Look at
The dates and see if recent reports meet policy standards.
Good evidence
Report shows ongoing monitoring with no deviations from organisational policies.
- Check 5 of 5What an auditor asks for
Ask for
Incident records related to unauthorised changes to mobile devices.
Look at
How many incidents, if any, occurred and what measures were taken.
Good evidence
Shows minimal or zero incidents with documented remedial action.
Mappings
Closest match in ISO/IEC 27001: A.8.1, Protection of user endpoint devices, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.1.
ISM-0864 requires mobile devices to prevent personnel from disabling or modifying provisioned security functionality. ISO/IEC 27001:2022 Annex A 8.1 requires protection of information on, processed by, or accessible via user endpoint devices, which includes mobile device security as part of broader endpoint protection. ISM-0864 is a specific technical enforcement mechanism within endpoint protection, whereas Annex A 8.1 covers a wider range of endpoint risks and safeguards beyond configuration immutability.
This control partially meets A.8.9.
ISM-0864 requires mobile devices to lock down security settings so users cannot disable or modify security functionality after provisioning. ISO/IEC 27001:2022 Annex A 8.9 requires configurations (including security configurations) to be established, implemented, monitored and reviewed across hardware, software, services and networks. ISM-0864 is one concrete configuration management outcome (preventing unauthorised local change on mobile devices), while Annex A 8.9 is broader and includes governance, documentation, monitoring and review across many technology domains.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.